address review comments

chainloop-dev · Aug 21, 2023 · e2edfe9 · e2edfe9
1 parent d53bd00
commit e2edfe9
Show file tree

Hide file tree

Showing 6 changed files with 116 additions and 112 deletions.
diff --git a/app/artifact-cas/internal/conf/conf.pb.go b/app/artifact-cas/internal/conf/conf.pb.go
diff --git a/app/artifact-cas/internal/conf/conf.proto b/app/artifact-cas/internal/conf/conf.proto
@@ -45,14 +45,14 @@ message Server {
   }
   message TLS {
     // path to certificate and private key
-    string Certificate = 1;
-    string PrivateKey = 2;
+    string certificate = 1;
+    string private_key = 2;
   }
   message GRPC {
     string network = 1;
     string addr = 2;
     google.protobuf.Duration timeout = 3;
-    TLS tlsConfig = 4;
+    TLS tls_config = 4;
   }
   // Regular HTTP endpoint
   HTTP http = 1;

diff --git a/app/artifact-cas/internal/server/grpc.go b/app/artifact-cas/internal/server/grpc.go
@@ -94,17 +94,20 @@ func NewGRPCServer(c *conf.Server, authConf *conf.Auth, byteService *service.Byt
 	if c.Grpc.Timeout != nil {
 		opts = append(opts, grpc.Timeout(c.Grpc.Timeout.AsDuration()))
 	}
-	cert := c.Grpc.TlsConfig.Certificate
-	privKey := c.Grpc.TlsConfig.PrivateKey
-	if cert != "" && privKey != "" {
-		cert, err := tls.LoadX509KeyPair(cert, privKey)
-		if err != nil {
-			return nil, err
+	if tlsConf := c.Grpc.GetTlsConfig(); tlsConf != nil {
+		cert := tlsConf.GetCertificate()
+		privKey := tlsConf.GetPrivateKey()
+		if cert != "" && privKey != "" {
+			cert, err := tls.LoadX509KeyPair(cert, privKey)
+			if err != nil {
+				return nil, fmt.Errorf("loading gRPC server TLS certificate: %w", err)
+			}
+			opts = append(opts, grpc.TLSConfig(&tls.Config{
+				Certificates: []tls.Certificate{cert},
+				MinVersion:   tls.VersionTLS12, // gosec complains about insecure minumum version we use default value
+			}))
 		}
-		opts = append(opts, grpc.TLSConfig(&tls.Config{
-			Certificates: []tls.Certificate{cert},
-			MinVersion:   tls.VersionTLS12,
-		}))
+
 	}
 	srv := grpc.NewServer(opts...)